How to Start a Medical Billing Company (2026 Guide)

Short answer

To start a third-party medical billing company, form an LLC, get an EIN and a Type 2 organizational NPI, sign a business associate agreement with every provider client, and enroll with payers and a clearinghouse before you transmit a single claim. No state or federal law requires a billing certification, but credentials from AAPC or HBMA signal competence to prospective clients. The market is large and fragmented: the Healthcare Business Management Association represents nearly 300 RCM firms covering more than 47,000 employees, a fraction of the full third-party billing field. Most new companies win their first clients through referrals from practice consultants, EHR vendors, and credentialing firms, not advertising. Plan for a six-to-twelve month ramp before the business is cash-flow positive.

What is the market opportunity?

Third-party medical billing is a durable services market. Independent practices, specialty groups, and outpatient clinics outsource billing because an in-house RCM team is expensive to build and retain and payer rules keep changing. A company serving multiple practices shares staffing, payer knowledge, and tool cost across its book in ways a single-practice billing department cannot.

The market is broad and fragmented: a handful of large national companies, more regional firms, and thousands of small shops focused on one or two specialties. Companies win on specialty depth, responsiveness, and transparent reporting, not price alone.

Key facts:

• HBMA membership spans nearly 300 firms representing more than 47,000 employees, per HBMA's membership statistics
• Most third-party billing companies serve between 5 and 30 provider clients; few operate at scale
• A specialty focus (behavioral health, chiropractic, pain management, podiatry) is a common early choice because payer rules are specialty-specific and deep expertise is a real differentiator

What business and legal setup is required?

Most new billing companies form an LLC in their state of operation. An LLC gives you liability separation and is straightforward to maintain. Multi-member LLCs should put a formal operating agreement in place from the start. Consult a business attorney on entity choice, especially if you plan to take on partners.

After formation, get an EIN (Employer Identification Number) from the IRS. You need it for payer enrollment, banking, and payroll.

You also need a Type 2 organizational NPI from NPPES. The Type 2 NPI identifies your company as the submitting entity on claims. The application is free, runs through the CMS National Plan and Provider Enumeration System, and a complete online application takes up to ten business days to process.

Sources: SBA.gov business structure guide, CMS NPPES

What certifications matter, and which are required?

No state or federal law requires a billing certification to operate a medical billing company. Anyone can legally start one. Certifications still matter in practice: payers and prospective clients use them as a proxy for competence, and staff credentials help during contract negotiations.

The main credentials in the field:

Practical notes on each:

• The AAPC CPB exam is 135 questions, needs a 70% passing score, and costs $499 for two attempts. AAPC sets no minimum education requirement, though two years of billing experience is the practical baseline.
• The HBMA CHBME is the credential tied to running a billing company, not just working in one. Eligibility requires 60 approved credit hours, at least 36 from HBMA-sponsored programs. The application fee is $350 for members and $700 for non-members. The exam is 75 questions over two hours.
• The AMBA CMRS is an open-book exam with 16 sections and an 85% cumulative passing score. AMBA membership at $99 per year is a prerequisite.

All three are optional, and all three carry credibility with new clients.

Sources: AAPC CPB page, HBMA CHBME page, AMBA CMRS page

What is your status under HIPAA, and what do you need to sign?

A third-party medical billing company is a business associate under HIPAA. HHS defines a business associate as any entity that uses or discloses protected health information on behalf of a covered entity. Billing, claims processing, and payment administration are listed examples in the regulation.

That has two concrete consequences:

• You must sign a Business Associate Agreement (BAA) with every provider client before you receive any PHI. The BAA governs how you handle, protect, and return or destroy their patient data.
• You are directly subject to HIPAA's Security Rule and Privacy Rule and can be fined by the HHS Office for Civil Rights in your own right, independent of your client. HHS publishes a model BAA template for reference.

A signed BAA is not optional. Do not accept any PHI from a provider client before the BAA is in place. This is non-negotiable from day one.

Beyond the BAA, you need administrative, physical, and technical safeguards: access controls, encryption for PHI at rest and in transit, a breach notification procedure, and workforce training documentation. HHS guidance for business associates is at hhs.gov/hipaa.

Sources: HHS Business Associates guidance, HHS model BAA

How do clearinghouse and payer enrollment work?

A clearinghouse is the electronic intermediary between your billing company and the payers. You send claims in a standard EDI format (837P for professional claims, 837I for institutional), the clearinghouse validates and routes them, and the payer's response comes back through the same channel. Without clearinghouse enrollment, you cannot transmit claims electronically.

Enrollment steps for a new billing company:

• Choose a clearinghouse. Major options include Change Healthcare (now Optum), Availity, Office Ally, and Waystar. Evaluate on payer connectivity, rejection reporting quality, and cost.
• Complete clearinghouse setup with your NPI, EIN, and the payer IDs you plan to submit to.
• Enroll separately with each payer for EDI submitter status. Every payer has its own form and process. Medicare enrollment runs through the CMS Provider Enrollment, Chain, and Ownership System (PECOS) or the region's MAC (Medicare Administrative Contractor). Private payers handle EDI enrollment directly or through your clearinghouse.

Timelines vary. Per CMS guidance, some Medicare-related enrollments take up to 30 business days; private payer enrollments typically take one to eight weeks. Account for this before you promise a client a go-live date.

Payer enrollment is not the same as provider credentialing. You are enrolling your billing company as an authorized EDI submitter, not credentialing the rendering providers. Providers still need to be credentialed and enrolled with each payer in their own right.

Sources: CMS Electronic Billing and EDI Transactions, CMS PECOS

What software does a new billing company need?

A billing company's software stack has three distinct layers. Conflating them is one of the most common early mistakes.

The PMS or EHR is almost always the provider's existing system. You work within it or alongside it, and most billing companies access the client's PMS directly to pull charges and post payments.

The clearinghouse sits between your billing workflow and the payers. It is not where you manage your own work.

The RCM workflow layer is the operational hub: where your team works denials, tracks A/R across all clients, posts ERAs, checks eligibility, and manages submissions. New billing companies think about this layer last, and it is the first one that limits growth.

Early on, many companies try to do RCM workflow work inside their clients' PMS systems, logging into one system per client. That does not scale past a handful of clients. The right tool for this layer is billing-company-first: your team, your work queues, all your client practices in one workspace.

How should you price your services?

Three pricing models dominate the market. Each has a different risk and cash-flow profile.

Percentage of collections is the most common model for third-party billing companies. It aligns your incentives with the provider's results and is familiar to most practice administrators.

Its main risk is timing: your revenue lags 30-90 days by payer mix, and a practice with backlogged or poorly managed A/R means a lot of work before meaningful collections arrive. Pre-engagement A/R audits and defined performance benchmarks in your service contract protect against this.

Per-claim pricing is less common in the US third-party market but used by some high-volume, specialty-focused operations. It gives you revenue predictability without the shared-outcome relationship most practices expect.

Sources: MGMA revenue cycle leakage benchmarks, industry rate range summary

How do you structure client contracts and protect your business?

Every provider client relationship needs two documents before any work begins: a service agreement and a signed BAA.

The service agreement should cover at minimum:

• Scope of services (which specialties, which payers, which workflow steps you own)
• Fee structure and payment terms (how collections are measured, when you invoice, net payment terms)
• Data access and data ownership (who owns the patient data; it is always the provider)
• Term and termination (notice period, what happens to open A/R at termination)
• Performance expectations and reporting cadence
• Indemnification and limitation of liability
• Dispute resolution

The BAA runs alongside the service agreement and governs PHI handling specifically. Some companies keep separate documents; some fold BAA terms into the service agreement. Either approach works under HIPAA as long as all required elements at 45 CFR 164.504(e) are present.

A few practical points:

• Define who works denials and appeals, and within what timeframe. Ambiguity here drives the most client disputes.
• Include an A/R handoff clause specifying how outstanding claims are handled if either party terminates.
• Specify the timely filing windows you are responsible for. If a client delivers charges after the payer's filing deadline, that is not your write-off.

Have a healthcare attorney review your initial service agreement and BAA. The one-time cost avoids larger problems later.

How do you get your first clients?

The first client is the hardest. Referrals from people who have seen you work are the most effective source, which is a bootstrapping problem when you are just starting. Get your first one or two clients through your existing network, not marketing.

Practical first-client strategies:

• Start with someone who knows you. A practice manager, physician, or office administrator from a previous employer is the most likely first client, because they already trust you.
• Partner with EHR vendors and practice management consultants. They constantly hear from practices unhappy with their billing, and many refer out if you can reliably serve their clients.
• Target practices with no existing billing relationship: a physician breaking out of a group to go independent, or a new specialty practice that has not set up billing yet.
• Join HBMA and list your company in their Find-a-Biller directory. Practices use this directory when searching for billing help.
• Pick a specialty and go deep. A company that clearly knows cardiology or behavioral health billing is more credible to a cardiologist or LCSW than a generalist shop.

Do not take on more clients than you can reliably serve in year one. A bad reference from an early client is much harder to overcome than slow growth.

What are the most common first-year mistakes?

The failures most billing companies hit in year one fall into predictable patterns.

**Taking on clients without vetting their A/R.** Inherit a backlogged A/R on a percentage-of-collections model and you may work months before meaningful revenue. Run a pre-engagement A/R audit before you quote a rate.

**Skipping or delaying the BAA.** Some new companies start receiving PHI before the BAA is signed because the relationship feels informal. That is a HIPAA violation regardless of intent. The BAA must be in place before any PHI changes hands.

**Underpricing to win the first client.** Percentage rates set in early contracts are hard to renegotiate. Price for the true cost of the work, including denial follow-up and appeals, not just initial submission.

**Managing multiple clients in multiple PMS systems with no cross-client view.** Logging into eight systems to check denial status across eight clients is not a billing company, it is eight part-time jobs. The layer above the PMS that gives you one view across clients is what makes the operation a real business.

**Ignoring timely filing deadlines during setup.** Payer enrollment and clearinghouse setup take weeks, and claims submitted after a payer's filing window are not payable. Know the deadlines for every payer your client uses before you accept their charges.

**Treating HIPAA as a one-time document exercise.** HIPAA requires ongoing workforce training, documented security policies, and a breach response procedure. Annual review is the minimum; build it into your operations calendar.

How Medi fits a new billing company

Medi is the multi-practice RCM workspace a billing company runs claims, denials, ERA posting, and eligibility on. It is built billing-company-first: your team, your work queues, your reporting, all your client practices in one place.

Medi handles:

• Claims submission and status tracking across all client practices
• Denial management and appeals workflow
• ERA (835) import and line-level posting
• Eligibility and coordination-of-benefits checks
• A/R aging and work queue prioritization
• Per-practice reporting that you can share with clients

Medi does not replace the provider's EHR or PMS. It does not do clinical coding, generate clinical documentation, submit prior authorizations, or schedule. It is the operational layer on top of whatever PMS your clients use.

Pricing is $20 per client practice per month, with volume pricing available. Claims are billed at $0.70 each (line-blind, ERA included), with volume discounts that step down to $0.65 per claim from 501 to 5,000 claims a month and $0.55 beyond 5,000. Eligibility is $0.25 per check, claim status $0.20, and COB inquiries, insurance discovery, and claim attachments $1.50 each. 277CA acknowledgments and PDFs are included. There is no per-provider fee and no contract. The full schedule is at Medi pricing.

Medi charges per client practice, not per provider. Adding providers inside a practice never changes the fee. Adding practices adds the per-practice rate.

To migrate from another platform, Medi is free with a 12-month commitment, or a one-time $100 per practice (capped at $3,000) month-to-month. Data export is always free with no termination fee.

See Medi pricing, try the pricing calculator, or read the billing company software evaluation guide. To see the product, book a demo.

When Medi is not the right fit

Medi is built for billing companies running claims and post-service revenue cycle work across multiple provider clients. It is probably not the right tool if:

• You are a single provider practice looking for a PMS or EHR, not an RCM workflow layer
• You need clinical coding software, a charge capture system, or a prior-authorization tool; Medi does none of those
• Your whole operation lives inside one client's PMS and you have no plans to add clients
• You need a clearinghouse itself rather than a workflow layer that connects to one

If you are starting a billing company and evaluating the full stack, the billing company software evaluation guide covers how the layers fit together and what to ask each vendor.

Frequently asked questions

Do I need a license to start a medical billing company?

No federal license or certification is required to operate a third-party medical billing company in the United States. Some states set requirements for certain healthcare businesses, so verify with your state's Department of Health or a local healthcare attorney first. What you do need: business formation (LLC or equivalent), an EIN, a Type 2 organizational NPI if you bill as an organization, clearinghouse and payer enrollment, and a signed BAA with every provider client before you receive any PHI. Certifications from AAPC, HBMA, or AMBA are optional but valuable for winning client trust. No licensing requirement does not mean no legal obligations: HIPAA applies to you as a business associate regardless of certification.

How much does it cost to start a medical billing company?

Startup costs are low compared to most businesses. State LLC filing fees run $50 to $500 depending on the state. The Type 2 NPI is free. A clearinghouse account is either a monthly fee or transaction-based, depending on the provider. Certifications are optional, but the AAPC CPB exam is $499 for two attempts and the HBMA CHBME is $350 for members or $700 for non-members plus a $99 test fee. You also need a HIPAA-compliant work environment (access controls, encrypted storage, audit capability), which carries software and security costs. Budget a few hundred to a few thousand dollars for a healthcare attorney to review your service agreement and BAA, depending on your market. Your largest early cost is usually your own time and foregone income during enrollment and ramp.

How long does it take to get paid after starting?

The timeline from signing your first client to your first payment is typically 60 to 120 days, set by how fast you complete payer and clearinghouse enrollment, how fast the client's payers pay, and your payment terms with the client. On a percentage-of-collections model, you only earn when the practice collects. Some payers pay within 14 days; others take 30 to 60. Plan working capital to cover operating costs for at least three to four months before revenue becomes reliable. The most common cash flow mistake new companies make is signing clients without accounting for this lag.

What is a business associate agreement and why does it matter?

A Business Associate Agreement (BAA) is a written contract HIPAA requires between a covered entity (your provider client) and any vendor that handles protected health information on its behalf. As a billing company, you are a business associate the moment you receive patient data. The BAA specifies what PHI you may use and for what purposes, requires appropriate safeguards, obligates you to report breaches, and defines what happens to PHI when the relationship ends. HHS publishes a model BAA at hhs.gov. You must have it signed before receiving any PHI, not after. The HHS Office for Civil Rights can fine business associates directly; penalties reach over $2 million per violation category under the HITECH Act.

What is the best specialty to focus on as a new billing company?

There is no universally best specialty, but some reward depth faster than others. Behavioral health, chiropractic, pain management, and podiatry are common entry points: high practice counts, distinct payer rules, and many independent practitioners who generic billing companies serve poorly. Avoid mental health billing unless you are ready for your state's Medicaid credentialing complexity. Avoid surgical billing at first without strong clinical coding knowledge, because clean claim rates ride on correct procedure and modifier combinations. Whatever you choose, go deep: know the common denial codes, the payer-specific rules, and the common documentation gaps. That knowledge is your actual product.

How many clients can one biller manage?

Capacity per biller varies widely by specialty, claim volume, denial rate, and how tool-assisted the workflow is. A rough industry reference is 75 to 200 providers per full-time biller for a low-complexity, high-volume specialty like primary care, and fewer for high-complexity specialties with frequent denials and appeals. Plan conservatively: build your workflows and reporting before you staff up, and hire before you are overwhelmed, not after. The most common scaling failure is taking on clients faster than the team can keep quality on existing work.